CVE-2026-80729 mm/huge_memory: initialise workingset state before folio split

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: initialise workingset state before folio split xastrysplit adds GFPACCOUNT for page-cache xanodes, but foliosplit leaves the xastate's xalru unset. That lets a live, memcg-charged xanode exist without being linked...

CVE-2026-80729

CVE-2026-80729 affects the Linux kernel in the mm/huge_memory subsystem. The root cause is that __folio_split() leaves the xa_state's xa_lru field unset, while xas_try_split() adds __GFP_ACCOUNT for page-cache xa_nodes. This allows a live, memcg-charged xa_node to exist without being linked into ...

Security update for apache2-mod_auth_openidc

This update for apache2-modauthopenidc fixes the following issue: CVE-2026-54789: out-of-bounds read and one-byte out-of-bounds write in the state-cookie parser of modauthopenidc bsc1276217. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

SUSE-SU-2026:3953-1 Security update for apache2-mod_auth_openidc

This update for apache2-modauthopenidc fixes the following issue: - CVE-2026-54789: out-of-bounds read and one-byte out-of-bounds write in the state-cookie parser of modauthopenidc bsc1276217...

Security update for apache2-mod_auth_openidc

This update for apache2-modauthopenidc fixes the following issue: CVE-2026-54789: out-of-bounds read and one-byte out-of-bounds write in the state-cookie parser of modauthopenidc bsc1276217. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

SUSE-SU-2026:3952-1 Security update for apache2-mod_auth_openidc

This update for apache2-modauthopenidc fixes the following issue: - CVE-2026-54789: out-of-bounds read and one-byte out-of-bounds write in the state-cookie parser of modauthopenidc bsc1276217...

kernel: nfsd: release layout stid on setlease failure

A flaw was found in the Linux kernel's Network File System Daemon nfsd. When a setlease operation fails, the system prematurely releases a layout state identifier. An attacker could exploit this by triggering the failure, leading to a use-after-free vulnerability. This could result in a system...

SUSE CVE-2026-74367

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix inconsistent arvif state in vdevcreate error paths ath12kmacvdevcreate has three error path issues that leave arvif in an inconsistent state: 1. When ath12kwmivdevcreate fails, the function returns directly...

PT-2026-84936

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The bpf tcp gen syncookie and bpf tcp check syncookie functions accept a socket pointer sk with the argument type ARG PTR TO BTF ID SOCK COMMON. The issue occurs because these functions...

PT-2026-84927

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where xas try split adds GFP ACCOUNT for page-cache xa nodes, but folio split fails to set the xa lru of the xa state. This allows a live, memcg-charged xa node to exist...

The vulnerability of the __do_adjtimex() function in the kernel/time/timekeeping.c module of the Linux operating system’s timer subsystem allows a attacker to cause a service failure.

The vulnerability of the doadjtimex function in the kernel/time/timekeeping.c module of the Linux operating system’s timer subsystem is related to state management errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the pci_doe_recv_resp() function in the drivers/pci/doe.c module of the Linux operating system’s PCI device driver allows a hacker to cause a service failure.

The vulnerability of the pcidoerecvresp function in the drivers/pci/doe.c module of the Linux PCI device driver is related to state management errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the sve_set_common() function in the arch/arm64/kernel/ptrace.c module, which is part of the ARM 64-bit kernel support in the Linux operating system, allows a malicious actor to trigger a service failure.

The vulnerability of the svesetcommon function in the arch/arm64/kernel/ptrace.c module, which is part of the ARM 64-bit kernel support for the Linux operating system, is related to state management errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the mchp_coreqspi_transfer_one() function in the drivers/spi/spi-microchip-core-qspi.c file of the Linux operating system’s SPI device driver allows a hacker to cause a service failure.

The vulnerability of the mchpcoreqspitransferone function in the drivers/spi/spi-microchip-core-qspi.c file of the Linux kernel’s SPI device driver is related to an incorrect definition of the internal state. Exploiting this vulnerability could allow an attacker to cause a system failure...

PT-2026-90893

In the Linux kernel, the following vulnerability has been resolved: bpf: Check sk state before sk protocol in bpf tcp syncookie bpf tcp gen syncookie and bpf tcp check syncookie accept a socket pointer 'sk' with argument type ARG PTR TO BTF ID SOCK COMMON. However, they access sk-sk protocol...

openSUSE 16 Security Update : apache2-mod_auth_openidc (openSUSE-SU-2026:21717-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21717-1 advisory. This update for apache2-modauthopenidc fixes the following issue: - CVE-2026-54789: out-of-bounds read and one-byte out-of-bounds write in the...

AZL-99285 CVE-2026-78662 affecting package moby-engine 25.0.3-20

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

AZL-99312 CVE-2026-78662 affecting package nvidia-container-toolkit 1.17.8-4

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

CVE-2026-78662 Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

[SECURITY] [DLA 4768-1] libapache2-mod-auth-openidc security update

Debian LTS Advisory DLA-4768-1 [email protected] https://www.debian.org/lts/security/ Daniel Leidert September 02, 2026 https://wiki.debian.org/LTS Package : libapache2-mod-auth-openidc Version : 2.4.12.3-2+deb12u5 CVE ID : CVE-2026-54789 A vulnerability has been found in modauthopenidc...